Identifying corporate machines on a VPN

I am fairly new to Fortigates having previously mostly used Cisco ASA/Sonicwall/Checkpoint, I like what I've seen so far but am struggling to find ways of authenticating or identifying a machine on a VPN.

I'm expecting to use the client and full tunnel, ideally over SSL.

What I cannot find in the manuals or cookbooks is the ability to authenticate a connecting machine as well as a user.  e.g. if I did this on a Cisco ASA I would have the choice or combination of several methods;

Machine certificate deployed through AD, a registry key, a file name or text file content, verified domain membership, verified AD computer group membership, certain software, firewall or AV version in place and iirc, some others.

I haven't worked in a company yet that allows (or wanted) non-corporate machines to connect to the corporate VPN so this is a fairly common requirement.

Can somebody point me to the right documentation?

Thanks.